Internal CA

Build your Internal PKI through a Private Certificate Authority (CA) hierarchy. This allows you to issue and manage X.509 certificates for internal services without relying on external CAs.

This page is for product admins setting up PKI infrastructure. Teams issuing certificates should see Applications.

How It Works

Create a Root CA — Or use an existing external root CA
Create Intermediate CA(s) — Chain them to your root CA
Create Certificate Profiles — Link CAs to policies for teams to use
Create Applications — Assign profiles to Applications for teams

You can execute this workflow via the UI or API. For API workflows, you may need to create CSRs and import certificates manually.

Create a CA Hierarchy

Create a simple Private CA hierarchy with a root CA and intermediate CA.

Infisical UI
API

Create a root CA

If you have an existing external root CA, skip to step 2.Go to Certificate Manager → Certificate Authorities → Internal and click Create CA.Set the CA Type to Root and fill out details for the root CA:

Valid Until: The date until which the CA is valid in the date time string format specified here. For example, the following formats would be valid: YYYY, YYYY-MM, YYYY-MM-DD, YYYY-MM-DDTHH:mm:ss.sssZ.
Path Length: The maximum number of intermediate CAs that can be chained to this CA. A path of -1 implies no limit; a path of 0 implies no intermediate CAs can be chained.
Key Algorithm: The type of public key algorithm and size, in bits, of the key pair that the CA creates when it issues a certificate. Supported key algorithms are RSA 2048, RSA 4096, ECDSA P-256, and ECDSA P-384 with the default being RSA 2048.
Name: A slug-friendly name for the CA.
Organization (O): The organization name.
Country (C): The country code.
State or Province Name: The state or province.
Locality Name: The city or locality.
Common Name: The name of the CA.

The Organization, Country, State or Province Name, Locality Name, and Common Name make up the Distinguished Name (DN) or subject of the CA. At least one of these fields must be filled out.

Creating an intermediate CA

To create an intermediate CA, press Create CA again but this time specifying the CA Type to be Intermediate. Fill out the details for the intermediate CA.Next, press the Install CA Certificate option on the intermediate CA. You will be presented with the installation method selector. Choose how the signing certificate should be issued:

Infisical CA
Manual
External CA

Select Infisical CA and press Continue. This option chains the intermediate CA to a root or intermediate CA managed by Infisical.Set the Parent CA to the root CA created in step 1 and configure:

Parent CA: The parent CA to chain to (the root CA from step 1).
Valid Until: Must be within the validity period of the parent CA.
Path Length: Must be less than the parent CA’s path length.

Press Install to chain the intermediate CA to the root CA. This creates a CSR, signs it with the root CA, and imports the certificate.You’ve successfully created a Private CA hierarchy. Now check out the Applications section to learn more about issuing certificates.

Creating a root CA

If you wish to use an external root CA, you can skip this step and head to step 2 to create an intermediate CA.To create a root CA, make an API request to the Create CA API endpoint, specifying the type as root.

Sample request

Request

curl --location --request POST 'https://app.infisical.com/api/v1/cert-manager/ca/internal' \
  --header 'Authorization: Bearer <access-token>' \
  --header 'Content-Type: application/json' \
  --data-raw '{
      "type": "root",
      "commonName": "My Root CA"
  }'

Sample response

Response

{
  ca: {
    id: "<root-ca-id>",
    type: "root",
    commonName: "My Root CA",
    ...
  }
}

By default, Infisical creates a root CA with the RSA_2048 key algorithm, validity period of 10 years, with no restrictions on path length; you may override these defaults by specifying your own options when making the API request.

Creating an intermediate CA

To create an intermediate CA, make an API request to the Create CA API endpoint, specifying the type as intermediate.

Sample request

Request

curl --location --request POST ‘https://app.infisical.com/api/v1/cert-manager/ca/internal’ \
  --header ‘Authorization: Bearer <access-token>’ \
  --header ‘Content-Type: application/json’ \
  --data-raw ‘{
      "type": "intermediate",
      "commonName": "My Intermediate CA"
  }’

Sample response

Response

{
  "ca": {
    "id": "<intermediate-ca-id>",
    "type": "intermediate",
    "commonName": "My Intermediate CA"
  }
}

Next, install a certificate for the intermediate CA using one of the following methods:

Infisical CA
Manual
External CA

Get a CSR from the intermediate CA, sign it with the root CA, and import the certificate back.Get the CSR:

Request

curl --location --request GET ‘https://app.infisical.com/api/v1/cert-manager/ca/internal/<intermediate-ca-id>/csr’ \
  --header ‘Authorization: Bearer <access-token>’

Sign the intermediate certificate using the root CA:

Request

curl --location --request POST ‘https://app.infisical.com/api/v1/cert-manager/ca/internal/<root-ca-id>/sign-intermediate’ \
  --header ‘Authorization: Bearer <access-token>’ \
  --header ‘Content-Type: application/json’ \
  --data-raw ‘{
      "csr": "<csr>",
      "notAfter": "2029-06-12"
  }’

The notAfter value must be within the validity period of the root CA.

Import the signed certificate back to the intermediate CA:

Request

curl --location --request POST ‘https://app.infisical.com/api/v1/cert-manager/ca/internal/<intermediate-ca-id>/import-certificate’ \
  --header ‘Authorization: Bearer <access-token>’ \
  --header ‘Content-Type: application/json’ \
  --data-raw ‘{
      "certificate": "<certificate>",
      "certificateChain": "<certificate-chain>"
  }’

You’ve successfully created a Private CA hierarchy. Now check out the Applications page to learn more about issuing certificates.

Get the CSR from the intermediate CA and use it to generate a certificate from your external root CA.Get the CSR:

Request

curl --location --request GET ‘https://app.infisical.com/api/v1/cert-manager/ca/internal/<intermediate-ca-id>/csr’ \
  --header ‘Authorization: Bearer <access-token>’

Use this CSR with your external root CA to generate a signed certificate. Then import the certificate and chain back:

Request

curl --location --request POST ‘https://app.infisical.com/api/v1/cert-manager/ca/internal/<intermediate-ca-id>/import-certificate’ \
  --header ‘Authorization: Bearer <access-token>’ \
  --header ‘Content-Type: application/json’ \
  --data-raw ‘{
      "certificate": "<certificate-from-external-ca>",
      "certificateChain": "<external-root-ca-certificate>"
  }’

You’ve successfully chained an intermediate CA to an external root CA. Now check out the Applications page to learn more about issuing certificates.

FAQ

What key algorithms are supported?

Infisical supports RSA 2048, RSA 4096, ECDSA P-256, ECDSA P-384 key algorithms specified at the time of creating a CA.

Does Infisical support chaining an Intermediate CA to an external CA?

Yes. You can either manually obtain a CSR and import the signed certificate, or use an integrated external CA provider like Venafi TLS Protect Cloud or Azure AD CS to automate the signing process.

What’s Next?

CA Renewal

Renew your CA certificates before they expire.

CRL Distribution Points

Configure CRL mirrors for high availability.

Certificate Profiles

Link your CA to a policy and create reusable profiles.

Applications

Set up Applications to issue certificates.

Certificate Management

Product Reference

Reference

How It Works

Create a CA Hierarchy

Sample request

Sample response

Sample request

Sample response

FAQ

What’s Next?

CA Renewal

CRL Distribution Points

Certificate Profiles

Applications

Certificate Management

Product Reference

Reference

Documentation Index

​How It Works

​Create a CA Hierarchy

​Sample request

​Sample response

​Sample request

​Sample response

​FAQ

​What’s Next?

CA Renewal

CRL Distribution Points

Certificate Profiles

Applications

How It Works

Create a CA Hierarchy

Sample request

Sample response

Sample request

Sample response

FAQ

What’s Next?